Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45701Sulu: Weak Cryptographical usage for API Key generation and Reset TokensPackagist · sulu/sulu · fixed in 3.0.6, 2.6.23
- CVE-2026-44740go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionGo · github.com/go-git/go-billy/v5, github.com/go-git/go-billy/v6 · fixed in 5.9.0, 6.0.0-alpha.1
- CVE-2026-44211Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerabilitynpm · cline
- CVE-2026-8643pip can extract console_scripts and gui_scripts outside installation directoryPyPI · pip · fixed in 26.1.2
- CVE-2026-10532Logback deserialization whitelist bypass for Proxy objectsMaven · ch.qos.logback:logback-core · fixed in 1.5.34
- CVE-2026-49328Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRFMaven · org.apache.fesod:fesod-sheet · fixed in 2.0.2-incubating
- CVE-2026-48827Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-gitMaven · org.apache.sshd:sshd-git · fixed in 2.18.0, 3.0.0-M4
- CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usersMaven · org.apache.solr:solr-core
- CVE-2026-49361Apache Fluss Netty Frame Decoder Memory Exhaustion VulnerabilityMaven · org.apache.fluss:fluss-common · fixed in 0.9.1-incubating
- CVE-2026-40861Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandlerPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-40961Apache Airflow: Open Redirect Bypass VulnerabilityPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-40963Apache Airflow: DAG authorization bypass on /ui/structure/structure_dataPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-41014Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpointsPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-49267Apache Airflow: No certificate validation on SMTP STARTTLS connectionsPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-41017Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxyPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-41084Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutationPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-42252Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user patternPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-42360Apache Airflow: Rendered template truncation bypasses nested sensitive-key maskingPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-42358Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secretsPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-42359Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validatorPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-45360Apache Airflow: Arbitrary import in custom deadline-reference deserializationPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-45426Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log accessPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.2
- CVE-2026-46764Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filterPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-48726Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout pathPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-49298Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-42253Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message PropertiesMaven · org.apache.activemq:activemq-web, org.apache.activemq:apache-activemq · fixed in 5.19.7, 6.2.6
- CVE-2026-42588Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.7, 6.2.6
- CVE-2026-45505Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper BypassMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.7, 6.2.6
- CVE-2026-46605Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removalMaven · org.apache.activemq:apache-activemq · fixed in 5.19.7, 6.2.6
- CVE-2026-49157Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by defaultMaven · org.apache.activemq:apache-activemq · fixed in 5.19.7, 6.2.6